{"id":"CVE-2026-59986","summary":"rabbitmq-c: amqp_decode_bytes size_t integer overflow bypasses bounds check on 32-bit (OOB read)","details":"rabbitmq-c is a C-language AMQP client library for RabbitMQ. Prior to version 0.17.0, the bounds check (*offset = o + len) \u003c= encoded.len overflows when o + len \u003e SIZE_MAX on 32-bit systems. len is a uint32_t read from the AMQP wire as a BYTES/UTF8 field length. The overflow wraps the check to a small value that passes, producing a decoded amqp_bytes_t with a multi-GB .len pointing into a small frame buffer. This results in an out-of-bounds read of up to ~4GB of process memory on 32-bit systems (ARM, MIPS, x86 ILP32, embedded IoT AMQP clients). Enabling information disclosure or denial of service. Not exploitable on 64-bit systems where size_t is 64-bit. This issue has been patched in version 0.17.0.","aliases":["GHSA-jgjf-7fwf-f3c7"],"modified":"2026-11-11T02:49:04.891244418Z","published":"2026-11-10T16:21:03.810Z","database_specific":{"cwe_ids":["CWE-125","CWE-190"],"osv_generated_from":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/59xxx/CVE-2026-59986.json","cna_assigner":"GitHub_M"},"references":[{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/59xxx/CVE-2026-59986.json"},{"type":"FIX","url":"https://github.com/alanxz/rabbitmq-c/pull/888"},{"type":"WEB","url":"https://github.com/alanxz/rabbitmq-c/releases/tag/v0.17.0"},{"type":"ADVISORY","url":"https://github.com/alanxz/rabbitmq-c/security/advisories/GHSA-jgjf-7fwf-f3c7"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-59986"}],"affected":[{"ranges":[{"type":"GIT","repo":"https://github.com/alanxz/rabbitmq-c","events":[{"introduced":"0"},{"fixed":"59df173fff72857896a8257bbfb72d9d29175f1e"}],"database_specific":{"extracted_events":[{"source":"AFFECTED_FIELD","strategy":"StringRangeExpression","range":[{"introduced":"0"},{"fixed":"0.17.0"}]},{"original_tag":"v0.17.0","range":[{"fixed":"59df173fff72857896a8257bbfb72d9d29175f1e"}],"source":"REFERENCES_TAG"}]}}],"versions":["v0.16.0","v0.15.0","v0.14.0","v0.13.0","v0.12.0","v0.11.0","v0.10.0","v0.9.0-master","v0.8.0","v0.7.1","v0.7.0","v0.6.0","v0.5.2","v0.5.1","v0.5.0","v0.4.0","v0.4.0-test","v0.3.0","rabbitmq-c-v0.3.0","v0.2","0.2","v0.1","librabbitmq-0.1-amqp_0_8"],"database_specific":{"source":"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-59986.json"}}],"schema_version":"1.9.2","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:H"}]}